femanager fails to check access permissions for the invitation component. Depending on the configuration of the plugin, a remote user can create frontend user accounts with access to configured frontend groups.

References

• in2code-de/femanager@cc5f289
• https://github.com/FriendsOfPHP/security-advisories/blob/master/in2code/femanager/CVE-2023-45023.yaml
• https://github.com/in2code-de/femanager/releases/tag/7.2.2
• https://typo3.org/security/advisory/typo3-ext-sa-2023-008